CVE-2025-53521: F5 BIG-IP APM Stack Buffer Overflow RCE (KEV, Reclassified from DoS)

CVE-2025-53521 is a stack-based buffer overflow in the apmd process of F5 BIG-IP Access Policy Manager that lets an attacker send specific malicious traffic to a virtual server with an APM access policy configured and achieve remote code execution; F5 first disclosed it as a denial-of-service issue in October 2025 but reclassified it as RCE in March 2026 after confirming real-world exploitation, and CISA added it to KEV the same week.

CVE-2025-53521 is a stack-based buffer overflow (CWE-121) in the apmd process of F5 BIG-IP Access Policy Manager (APM). NVD's description states "When a BIG-IP APM access policy is configured on a virtual server, specific malicious traffic can lead to Remote Code Execution (RCE)" and notes that software versions past End of Technical Support are not evaluated (NVD).

As of this check, NVD's vulnStatus is "Analyzed" but NVD has not published its own independent Primary CVSS metric; the only scores on file are F5's own CNA Secondary submissions: CVSS v3.1 9.8 (critical), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, and CVSS v4.0 9.3. Both figures are F5's, not NVD-confirmed (NVD).

F5's security advisory K000156741 documents a notable timeline: the vulnerability was originally disclosed on 2025-10-15 as a denial-of-service issue, then reclassified to remote code execution on 2026-03-29 after F5 received new information that a threat actor had exploited it to achieve code execution. F5's own fixed-version table lists 15.1.10.8, 16.1.6.1, 17.1.3 and 17.5.1.3 as the patched releases for each affected train, and F5 recommends organizations running a vulnerable version — or that have since upgraded from one — review companion article K000160486 and perform a compromise assessment regardless of patch status, since the reclassification followed confirmed exploitation. Mitigation beyond patching includes restricting network access to virtual servers that have an APM access policy applied and isolating the management interface from the public internet (F5 Security Advisory K000156741).

CISA added CVE-2025-53521 to the Known Exploited Vulnerabilities (KEV) catalog on 2026-03-27, two days before F5's public reclassification, confirming active exploitation in the wild (catalog confirmed live this run, matched by exact cveID string against the raw KEV feed) (CISA KEV).

As of 2026-10-31, FIRST scores the probability of exploitation at 0.0230 (83.24th percentile) (FIRST EPSS).

Given the confirmed exploitation and the fact that F5 recommends a compromise assessment even for already-patched systems, any BIG-IP APM instance on an affected train should be upgraded to the fixed release and checked for indicators of prior compromise, not just patched and assumed safe.

• Stack-based buffer overflow in BIG-IP APM's apmd process: when an APM access policy is configured on a virtual server, specific malicious traffic can lead to remote code execution. — NVD
• Only scores on file are F5's own CNA Secondary submissions: CVSS v3.1 9.8 and CVSS v4.0 9.3; NVD has not published an independent Primary metric for this record. — NVD
• Disclosed 2025-10-15 as a DoS issue, reclassified 2026-03-29 to RCE after confirmed exploitation; fixed releases 15.1.10.8, 16.1.6.1, 17.1.3, 17.5.1.3; F5 recommends a compromise assessment on affected and already-patched systems alike. — F5 Security Advisory K000156741
• Added to the CISA Known Exploited Vulnerabilities catalog on 2026-03-27, confirming active exploitation. Confirmed present in the live KEV feed by exact cveID match this run. — CISA KEV
• EPSS score is 0.0230 (83.24th percentile) as of 2026-10-31. — FIRST EPSS